CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,672 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
36,466 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-4071 EXP | Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows r… | Patch early | 9.8 critical | 19.5% | 2016-05-20 |
| CVE-2016-4372 EXP | HPE iMC PLAT before 7.2 E0403P04, iMC EAD before 7.2 E0405P05, iMC APM before 7.2 E0401P04, iMC NTA before 7.2 E0401P01, iMC BIMS before 7.2 E0402P02,… | Patch early | 9.8 critical | 19.4% | 2016-07-15 |
| CVE-2025-64459 EXP | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `Que… | Patch early | 9.1 critical | 19.4% | 2025-11-05 |
| CVE-2017-14094 EXP | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution… | Patch early | 9.8 critical | 19.4% | 2018-01-19 |
| CVE-2017-7997 EXP | Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter… | Patch early | 9.8 critical | 19.3% | 2018-01-08 |
| CVE-2019-19208 EXP | Codiad Web IDE through 2.8.4 allows PHP Code injection. | Patch early | 9.8 critical | 19.2% | 2020-03-16 |
| CVE-2016-6598 EXP | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service conta… | Patch early | 9.8 critical | 19.2% | 2018-01-30 |
| CVE-2013-3684 EXP | NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload | Patch early | 9.8 critical | 19.2% | 2020-02-11 |
| CVE-2016-2208 EXP | The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denia… | Patch early | 9.1 critical | 19.2% | 2016-05-19 |
| CVE-2017-16949 EXP | An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the at… | Patch early | 9.8 critical | 19.2% | 2017-12-19 |
| CVE-2018-5988 EXP | SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php. | Patch early | 9.8 critical | 19.2% | 2018-01-24 |
| CVE-2018-5985 EXP | SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request. | Patch early | 9.8 critical | 19.2% | 2018-01-24 |
| CVE-2018-7313 EXP | SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter. | Patch early | 9.8 critical | 19.2% | 2018-02-22 |
| CVE-2018-6583 EXP | SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request. | Patch early | 9.8 critical | 19.2% | 2018-02-17 |
| CVE-2018-6006 EXP | SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter. | Patch early | 9.8 critical | 19.2% | 2018-02-17 |
| CVE-2018-5972 EXP | SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listing URI. | Patch early | 9.8 critical | 19.2% | 2018-01-24 |
| CVE-2018-5979 EXP | SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field. | Patch early | 9.8 critical | 19.2% | 2018-01-24 |
| CVE-2015-5995 EXP | Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative ac… | Patch early | 9.8 critical | 19.1% | 2015-12-31 |
| CVE-2017-17849 EXP | A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to execute arbitrary code on NAS devi… | Patch early | 9.8 critical | 19% | 2017-12-27 |
| CVE-2024-6298 EXP | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to ex… | Patch early | 10.0 critical | 19% | 2024-07-05 |
| CVE-2017-1000375 EXP | NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate m… | Patch early | 9.8 critical | 18.9% | 2017-06-19 |
| CVE-2005-0199 EXP | Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (application… | Patch early | 9.8 critical | 18.8% | 2005-05-02 |
| CVE-2019-13294 EXP | AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthentica… | Patch early | 9.8 critical | 18.8% | 2019-07-04 |
| CVE-2018-5782 EXP | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, c… | Patch early | 9.8 critical | 18.7% | 2018-03-14 |
| CVE-2018-20469 EXP | An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be… | Patch early | 9.8 critical | 18.5% | 2019-06-17 |
| CVE-2017-5465 EXP | An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being… | Patch early | 9.1 critical | 18.5% | 2018-06-11 |
| CVE-2025-20124 EXP | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected dev… | Patch early | 9.9 critical | 18.5% | 2025-02-05 |
| CVE-2018-5701 EXP | In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not validating inp… | Patch early | 9.8 critical | 18.5% | 2018-01-31 |
| CVE-2020-25787 EXP | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them. | Patch early | 9.8 critical | 18.4% | 2020-09-19 |
| CVE-2022-25089 EXP | Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.Persisten… | Patch early | 9.8 critical | 18.4% | 2022-03-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt